roofcakes[.]info

This domain, roofcakes.info, operates as a fake login portal designed to harvest user credentials for financial accounts or sensitive services. Analysis indicates the site presents itself as a legitimate authentication page, tricking visitors into entering login details that are immediately captured by threat actors. The site may also attempt to distribute secondary payloads or redirect users to additional fraudulent resources once credentials are obtained. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on May 05, 2026, through NameCheap, Inc., an uncommon registrar choice for legitimate services in this sector. It resolves to IP address 104.21.74.174, hosted by Cloudflare in Canada, which is frequently leveraged to obscure origin servers. Security vendors on VirusTotal have flagged the domain, with 16 out of 95 engines detecting it as malicious. The domain appears on two independent security blocklists and is actively blocked by enterprise-grade security filters. If you visited roofcakes.info or entered any information on the site, immediate action is required. Disconnect the affected device from the network to prevent potential data exfiltration. Reset all passwords for accounts that may have been exposed, prioritizing financial, email, and work-related credentials. Enable multi-factor authentication wherever possible to mitigate unauthorized access. Monitor accounts for suspicious activity, including unauthorized transactions or login attempts. Consider scanning the device with updated security tools to detect any installed malware or backdoors. Report the incident to relevant authorities or your organization’s security team for further investigation.